release.yml

name: Publish to PyPI

# Publishes when you push a version tag like v0.2.0.
# Uses PyPI Trusted Publishing (OIDC) — no API token stored in the repo.
# One-time setup: on pypi.org add a "pending publisher" for project `riskkit`,
# owner `HasibVortex369`, repo `riskkit`, workflow `release.yml`, environment `pypi`.

on:
  push:
    tags: ["v*"]

jobs:
  build-and-publish:
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write   # required for trusted publishing
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Build
        run: |
          python -m pip install --upgrade build
          python -m build
      - name: Publish
        uses: pypa/gh-action-pypi-publish@release/v1